Infrastructure
Step-by-step connection and configuration for Kubernetes, Terraform and Confluent / Kafka.
What is running, what changed, and what got stuck in a queue on the way.
Kubernetes
kubernetes · runs mcp-server-kubernetes via npx · destructive tools are
disabled by a flag this catalog pins on.
This one is usually a personal data source, not a shared one
The credential is a file path on the member's own machine. Unless every member keeps their kubeconfig at the same absolute path, configure this per-member instead — use Pre-add data sources for members on the Organization page to drop a placeholder row into each member's own list. See Integrations.
Create a read-only service account and a kubeconfig for it, rather than pointing at a cluster-admin context:
kubectl create serviceaccount triagic -n default
kubectl create clusterrolebinding triagic-view \
--clusterrole=view --serviceaccount=default:triagicThen build a kubeconfig from that service account's token. The view ClusterRole is
Kubernetes' own read-only aggregate.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Kubeconfig path | yes | An absolute path on the machine running Triagic, e.g. /Users/you/.kube/config. Not a path on the portal's host. |
| Context | no | Defaults to the kubeconfig's current context. Set it to pin a cluster, so a member switching contexts locally doesn't repoint the integration. |
Verify. Health check lists API resources.
Terraform
terraform · runs HashiCorp's official terraform-mcp-server image via Docker ·
scoped to the workspace/run/state toolset, with run and apply operations disabled.
This is for answering what changed — workspaces, runs, plans, plan logs, apply logs and state versions — rather than for reading public registry documentation.
Create an API token. HCP Terraform → Account settings → Tokens, or a team token scoped to read access, which is the least-privilege option. User, team and organization tokens all work.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Terraform address | no, defaults https://app.terraform.io | Set your own URL for Terraform Enterprise. Remember the server runs in a container — a self-hosted instance on the same machine needs host.docker.internal. |
| API token | yes |
Verify. Health check is whoami, which fails precisely when the token is wrong.
Without it the server would still start — the registry side needs no token at all —
and every workspace tool would fail later instead.
| If it reports | It usually means |
|---|---|
401 | Wrong token, or a token belonging to a different organization. |
404 | Authenticated but cannot see that organization or workspace — team tokens are scoped, so check the team has read access. |
x509 / certificate | A Terraform Enterprise certificate the container doesn't trust. Use a hostname whose certificate chains to a public CA. |
Confluent / Kafka
confluent · runs @confluentinc/mcp-confluent via npx · read-only is enforced
with an explicit allow-list of read tools, so produce-message, delete-topics,
connector mutations and the Flink/Tableflow write families are simply not offered.
Only the first three fields are required. Each remaining block unlocks a group of tools, and a block that is incomplete makes its tools absent rather than broken — which is the single most confusing failure mode here.
Create a Kafka API key. Confluent Cloud → your cluster → API keys → Add key. Keys are per-cluster; a key from a sibling cluster fails with an authentication error.
Collect the cluster's REST endpoint and ID from the cluster overview, if you want the topic and consumer-group tools (you do — consumer lag is the point).
Optionally add the control-plane and Schema Registry keys. The Confluent Cloud API key is a separate, account-level key that lists environments and clusters. The Schema Registry endpoint has its own key pair again.
Fill the form.
| Field | Required | What it unlocks |
|---|---|---|
| Bootstrap servers | yes | pkc-abc12.us-east-1.aws.confluent.cloud:9092, comma-separated, ports included. |
| Kafka API key / secret | yes | Consuming messages, consumer groups. |
| Kafka REST endpoint | no | Topic and consumer-group tools. https://pkc-abc12….confluent.cloud:443 |
| Kafka cluster ID | no | Required alongside the REST endpoint. lkc-abc123 |
| Confluent Cloud API key / secret | no | Listing environments, clusters, organizations. |
| Schema Registry endpoint + key / secret | no | Reading schemas. |
Verify. Health check lists topics — a real Kafka read, deliberately not one of the server's credential-free diagnostics, which would answer happily for a broken config.
| If it reports | It usually means |
|---|---|
unknown tool / tool not available | A configuration block is incomplete, not a broken server. Topic and consumer-group tools need the REST endpoint and the cluster ID. |
401 / 403 / SASL | The Kafka key and secret must be a matching pair issued for this cluster. |
ETIMEDOUT, ECONNREFUSED | The brokers didn't answer from that machine. Check the port is in Bootstrap servers and the network is reachable. |